A frame may pass from a source address to a destination address in a communications network, subject to imposed constraints such as zoning restrictions in a Fibre Channel (FC) network. Travel between such a pair of communicating endpoint network addresses is known as a frame flow (a “flow”). Communications networks typically handle a large number of flows. Generally, such flows travel within a communications network from a source device to a destination device through one or more switching devices. Different frame flows have a variety of different duration and flow sizes. While most flows are short-lived, a majority of frames belong to long-lived flows. Many of the long-lived flows are also large flows.
Long-lived large flows generally create more traffic across a network than other flows. Therefore, identifying long-lived large flows and their activity levels is desirable to detect traffic congestion causes to route around congestion. Identifying such flows is also useful for backup transactions, virtual machine migration operations, long-form video contents, load balancing, preventing denial of service attaches, and reporting to a network administrator. U.S. Pat. No. 7,733,805, titled “Method and Apparatus for Determining Bandwidth-consuming Frame Flows in a Network,” which is incorporated herein by reference, discusses a method for identifying long-lived flows in a Fibre Channel network. While this method works for FC networks, it is not easily scalable to Ethernet and IP networks due to a significant increase in the number of flows that are typically present in an IP or Ethernet network.
Monitoring frame flows to identify long-lived large flows is not an easy task, because merely knowing the endpoints and the various ports involved is not sufficient, as the actual data transfer levels must also be measured. While this may be simple in theory, in an actual network, particularly an IP network, the sheer number of frame flows renders the task difficult. Moreover, concurrently monitoring and maintaining a flow traffic record of all flows presents a substantial resource obstacle. Additionally, methods used for identifying long-lived large frames generally result in a high percentage of false positive identification of short-lived small flows as long-lived large flows.
Therefore, what is desirable is a novel process and system that efficiently identifies long-lived large flows in a variety of communication networks while minimizing false positive identification of short-lived small flows as long-lived large flows.